CVE-2026-3385CWE-404CWE-674

wren-lang wren wren_compiler.c resolveLocal recursion

Medium · published March 1, 2026

CVSS v4.0
4.8
EPSS
0%
Percentile
9.2
In the wild
Unconfirmed
What it is

A vulnerability was detected in wren-lang wren up to 0.4.0. Affected is the function resolveLocal of the file src/vm/wren_compiler.c. The manipulation results in uncontrolled recursion. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v4.0
4.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00199 · 9.2th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-674 · Uncontrolled Recursion
Published
2026-03-01T08:32Z
EPSS history
Timeline
  • 01 MAR 08:32Z
    wren-lang wren wren_compiler.c resolveLocal recursion
    cvelistv5